Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2023, 13:28

General

  • Target

    276096409e2c0f552d9d99800c8a8db3d523f794fe458c91827961bc92dcaf26.exe

  • Size

    1021KB

  • MD5

    0e040f3df327afddd358c6fa5332cb4c

  • SHA1

    9705e64bc2be5979c8a630db8dd3bf4cf3f5621a

  • SHA256

    276096409e2c0f552d9d99800c8a8db3d523f794fe458c91827961bc92dcaf26

  • SHA512

    3dc55683efc877e2ba28522c1a92dcfc57fe12016caf2f798028fdca77e4c358867d9c212e0ea58e0d99d351a1d977efcada6b3279444a4be61dfe219ce9ff56

  • SSDEEP

    24576:1y/SjSHiWzZy9yYahEc3Cfr5u+LKZdOPZuDbksvVM:QQCVzZy07hrqM+LKvO0Dgsv

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

trap

C2

193.233.20.30:4125

Attributes
  • auth_value

    b39a737e2e9eba88e48ab88d1061be9c

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\276096409e2c0f552d9d99800c8a8db3d523f794fe458c91827961bc92dcaf26.exe
    "C:\Users\Admin\AppData\Local\Temp\276096409e2c0f552d9d99800c8a8db3d523f794fe458c91827961bc92dcaf26.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5024.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5024.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1213.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1213.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3969.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3969.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9783.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9783.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1436
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5901.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5901.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4808
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1080
              6⤵
              • Program crash
              PID:1936
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dRj00s16.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dRj00s16.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4848
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1340
            5⤵
            • Program crash
            PID:3220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en213862.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en213862.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge264562.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge264562.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
        "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1840
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4496
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "metafor.exe" /P "Admin:N"
              5⤵
                PID:4728
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metafor.exe" /P "Admin:R" /E
                5⤵
                  PID:4724
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2056
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\5975271bda" /P "Admin:N"
                    5⤵
                      PID:3440
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\5975271bda" /P "Admin:R" /E
                      5⤵
                        PID:3964
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4808 -ip 4808
                1⤵
                  PID:3544
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4848 -ip 4848
                  1⤵
                    PID:4356
                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2872

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge264562.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge264562.exe

                    Filesize

                    226KB

                    MD5

                    8627ebe3777cc777ed2a14b907162224

                    SHA1

                    06eeed93eb3094f9d0b13ac4a6936f7088fbbdaa

                    SHA256

                    319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb

                    SHA512

                    9de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5024.exe

                    Filesize

                    839KB

                    MD5

                    7b7b4fa7fa1c448b6f57b3b4909ae18b

                    SHA1

                    b82a2d2f1d968f110113429e61f86e178d453b84

                    SHA256

                    c3ab4471b0085da44e26b6ae6b3936ad7899aef342bd175f0ba33b027a195c86

                    SHA512

                    8236aea8c46fdf977db9257cb5cdf5626750074a33072ed19d293bffa8d2d9f777bc3fade50305f4bbc61a0538b8b0df2c7a25be34562e366abbcfc1eadd6793

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino5024.exe

                    Filesize

                    839KB

                    MD5

                    7b7b4fa7fa1c448b6f57b3b4909ae18b

                    SHA1

                    b82a2d2f1d968f110113429e61f86e178d453b84

                    SHA256

                    c3ab4471b0085da44e26b6ae6b3936ad7899aef342bd175f0ba33b027a195c86

                    SHA512

                    8236aea8c46fdf977db9257cb5cdf5626750074a33072ed19d293bffa8d2d9f777bc3fade50305f4bbc61a0538b8b0df2c7a25be34562e366abbcfc1eadd6793

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en213862.exe

                    Filesize

                    175KB

                    MD5

                    581e8f97deca3769f1bc14882c9f26dc

                    SHA1

                    b69eb0b0c175888de0fa1ea7a0a045d69138d18e

                    SHA256

                    b277fd59e05cce33d218d0e9720f041eff2d7a5477b1e2843a6123aad307cd86

                    SHA512

                    f56835f4598bb5b121071373d760facd9173efdfadb741f99e3752c825f558b92922a3813606130ff0ed0f886d2d2858a0412d42284d3a941f0702d08eaec065

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\en213862.exe

                    Filesize

                    175KB

                    MD5

                    581e8f97deca3769f1bc14882c9f26dc

                    SHA1

                    b69eb0b0c175888de0fa1ea7a0a045d69138d18e

                    SHA256

                    b277fd59e05cce33d218d0e9720f041eff2d7a5477b1e2843a6123aad307cd86

                    SHA512

                    f56835f4598bb5b121071373d760facd9173efdfadb741f99e3752c825f558b92922a3813606130ff0ed0f886d2d2858a0412d42284d3a941f0702d08eaec065

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1213.exe

                    Filesize

                    697KB

                    MD5

                    8fc0f034e5b06ccff5105645f8f4d95d

                    SHA1

                    fc108a80a851e7780112351ced0a4f9c9731d437

                    SHA256

                    c3bdb58f3dab36d37cd2784cdabd313a19b6ea4177e655aa7f276306b10bf3f1

                    SHA512

                    401b45123a444a155a2c0f01e1b55f42e40886716acc1a988c98a25de13f161a7341ecf06fae55dd922bee748288036fe8a814348746b1677a73fc257c3dde90

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino1213.exe

                    Filesize

                    697KB

                    MD5

                    8fc0f034e5b06ccff5105645f8f4d95d

                    SHA1

                    fc108a80a851e7780112351ced0a4f9c9731d437

                    SHA256

                    c3bdb58f3dab36d37cd2784cdabd313a19b6ea4177e655aa7f276306b10bf3f1

                    SHA512

                    401b45123a444a155a2c0f01e1b55f42e40886716acc1a988c98a25de13f161a7341ecf06fae55dd922bee748288036fe8a814348746b1677a73fc257c3dde90

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dRj00s16.exe

                    Filesize

                    351KB

                    MD5

                    5e0b6744aea66bfa0bb1605f74120aa7

                    SHA1

                    b6ee332ffff637fac25e7a9e9c2581f61604f781

                    SHA256

                    008341174516ff160ee96358f7cdf028f02362384fb6f21d11d6d39414bcc1e7

                    SHA512

                    fc23fba57fbff766af7a6ce44aca844bd5445e3afdcd9fac60be6d190a75f873d37460488497b15dffdd9e33cf730b5f36535d408ef458bdfd8bdcd8d8634efb

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dRj00s16.exe

                    Filesize

                    351KB

                    MD5

                    5e0b6744aea66bfa0bb1605f74120aa7

                    SHA1

                    b6ee332ffff637fac25e7a9e9c2581f61604f781

                    SHA256

                    008341174516ff160ee96358f7cdf028f02362384fb6f21d11d6d39414bcc1e7

                    SHA512

                    fc23fba57fbff766af7a6ce44aca844bd5445e3afdcd9fac60be6d190a75f873d37460488497b15dffdd9e33cf730b5f36535d408ef458bdfd8bdcd8d8634efb

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3969.exe

                    Filesize

                    344KB

                    MD5

                    035ec42793a7a847970341c8fc08e748

                    SHA1

                    f7d7288b173a9fc4ed2f660d5cea0a8010dd072e

                    SHA256

                    2d1e79a37256fee954c16271b54c273d0b10a8876b23c84cc87329537378022a

                    SHA512

                    d81bf1d8efb8777ddeff0a375f6eb95b2fa4bd547940db3b5c027e6159c7354a420220399d822a3846c2b2db30a9620b02b9bf246d0de249fdb986a016cc943a

                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino3969.exe

                    Filesize

                    344KB

                    MD5

                    035ec42793a7a847970341c8fc08e748

                    SHA1

                    f7d7288b173a9fc4ed2f660d5cea0a8010dd072e

                    SHA256

                    2d1e79a37256fee954c16271b54c273d0b10a8876b23c84cc87329537378022a

                    SHA512

                    d81bf1d8efb8777ddeff0a375f6eb95b2fa4bd547940db3b5c027e6159c7354a420220399d822a3846c2b2db30a9620b02b9bf246d0de249fdb986a016cc943a

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9783.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus9783.exe

                    Filesize

                    11KB

                    MD5

                    7e93bacbbc33e6652e147e7fe07572a0

                    SHA1

                    421a7167da01c8da4dc4d5234ca3dd84e319e762

                    SHA256

                    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                    SHA512

                    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5901.exe

                    Filesize

                    291KB

                    MD5

                    65d86f546eb61aac8ada47c322e9df61

                    SHA1

                    19fd7e16df194a1e2321a9fee778510f7f071f59

                    SHA256

                    a6690fb093013d127840ffdb7f6ba7e33add604593776e0d0228d4b4d7633409

                    SHA512

                    915f8b226cfe4f8fdf4d40cd09c7cd4407e48a78f0cbb5d4eb90eb1ae33b99a8fbdc8e3bfe2c70c0ea6e21b84c0c8dc3112d704f6897e5ec9253c6009944a773

                  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5901.exe

                    Filesize

                    291KB

                    MD5

                    65d86f546eb61aac8ada47c322e9df61

                    SHA1

                    19fd7e16df194a1e2321a9fee778510f7f071f59

                    SHA256

                    a6690fb093013d127840ffdb7f6ba7e33add604593776e0d0228d4b4d7633409

                    SHA512

                    915f8b226cfe4f8fdf4d40cd09c7cd4407e48a78f0cbb5d4eb90eb1ae33b99a8fbdc8e3bfe2c70c0ea6e21b84c0c8dc3112d704f6897e5ec9253c6009944a773

                  • memory/1436-162-0x000000001AF50000-0x000000001B09E000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/1436-164-0x000000001AF50000-0x000000001B09E000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/1436-161-0x0000000000360000-0x000000000036A000-memory.dmp

                    Filesize

                    40KB

                  • memory/3840-1141-0x0000000000950000-0x0000000000982000-memory.dmp

                    Filesize

                    200KB

                  • memory/3840-1142-0x0000000005530000-0x0000000005540000-memory.dmp

                    Filesize

                    64KB

                  • memory/4808-179-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-183-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-185-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-187-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-189-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-191-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-193-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-195-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-197-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-199-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-201-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-202-0x0000000000400000-0x000000000070C000-memory.dmp

                    Filesize

                    3.0MB

                  • memory/4808-203-0x0000000004F20000-0x0000000004F30000-memory.dmp

                    Filesize

                    64KB

                  • memory/4808-205-0x0000000000400000-0x000000000070C000-memory.dmp

                    Filesize

                    3.0MB

                  • memory/4808-181-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-177-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-175-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-174-0x0000000002840000-0x0000000002852000-memory.dmp

                    Filesize

                    72KB

                  • memory/4808-173-0x0000000004F30000-0x00000000054D4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4808-172-0x0000000004F20000-0x0000000004F30000-memory.dmp

                    Filesize

                    64KB

                  • memory/4808-170-0x0000000004F20000-0x0000000004F30000-memory.dmp

                    Filesize

                    64KB

                  • memory/4808-171-0x0000000004F20000-0x0000000004F30000-memory.dmp

                    Filesize

                    64KB

                  • memory/4808-169-0x00000000007E0000-0x000000000080D000-memory.dmp

                    Filesize

                    180KB

                  • memory/4848-213-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-228-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-230-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-226-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-232-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-234-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-236-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-238-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-240-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-242-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-244-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-639-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-1120-0x0000000005460000-0x0000000005A78000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/4848-1121-0x0000000005B00000-0x0000000005C0A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/4848-1122-0x0000000005C40000-0x0000000005C52000-memory.dmp

                    Filesize

                    72KB

                  • memory/4848-1123-0x0000000005C60000-0x0000000005C9C000-memory.dmp

                    Filesize

                    240KB

                  • memory/4848-1124-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-1125-0x0000000005F50000-0x0000000005FB6000-memory.dmp

                    Filesize

                    408KB

                  • memory/4848-1126-0x0000000006610000-0x00000000066A2000-memory.dmp

                    Filesize

                    584KB

                  • memory/4848-1128-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-1129-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-1130-0x0000000006850000-0x00000000068C6000-memory.dmp

                    Filesize

                    472KB

                  • memory/4848-1131-0x00000000068E0000-0x0000000006930000-memory.dmp

                    Filesize

                    320KB

                  • memory/4848-1132-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-1133-0x0000000006A40000-0x0000000006C02000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/4848-1134-0x0000000006C20000-0x000000000714C000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/4848-224-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-222-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-220-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-218-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-214-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-216-0x0000000005280000-0x00000000052BE000-memory.dmp

                    Filesize

                    248KB

                  • memory/4848-212-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-211-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB

                  • memory/4848-210-0x0000000002260000-0x00000000022AB000-memory.dmp

                    Filesize

                    300KB

                  • memory/4848-1135-0x0000000002740000-0x0000000002750000-memory.dmp

                    Filesize

                    64KB